Control service for data management

ABSTRACT

Aspects of a data environment, such as the creation, provisioning, and management of data stores and instances, are managed using a separate control environment. A user can call into an externally-facing interface of the control environment, the call being analyzed to determine actions to be performed in the data environment. A monitoring component of the control plane also can periodically communicate with the data environment to determine any necessary actions to be performed, such as to recover from faults or events in the data environment. A workflow can be instantiated that includes tasks necessary to perform the action. For each task, state information can be passed to a component in the data environment operable to perform the task, until all tasks for an action are completed. Data in the data environment can be accessed directly using an externally-facing interface of the data environment, without accessing the control plane.

CROSS REFERENCE TO RELATED APPLICATION

This application is a continuation of U.S. patent application Ser. No.14/257,927, filed Apr. 21, 2014, which is a continuation of U.S. patentapplication Ser. No. 12/415,958, filed Mar. 31, 2009, now U.S. Pat. No.8,713,060, which are hereby incorporated by reference herein in theirentirety.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialthat is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

BACKGROUND

As an increasing number of applications and services are being madeavailable over networks such as the Internet, an increasing number ofcontent, application, and/or service providers are turning totechnologies such as cloud computing. Cloud computing, in general, is anapproach to providing access to electronic resources through services,such as Web services, where the hardware and/or software used to supportthose services is dynamically scalable to meet the needs of the servicesat any given time. A user or customer typically will rent, lease, orotherwise pay for access to resources through the cloud, and thus doesnot have to purchase and maintain the hardware and/or software toprovide access to these resources.

Various services have been developed that enable a customer to adjustthe compute capacity for an application or service in the cloud overtime, making Web-scale computing easier for developers. In some cases, aWeb service interface is provided that enables a customer to managecomputing capacity, such as to obtain or boot new server instances inorder to quickly scale capacity, both up and down, as computingrequirements change.

The adjusting of capacity can be advantageous for applications availableacross a network or from a remote location. Oftentimes, theseapplications will rely on, or take advantage of, at least one data storeor other such repository hosting data that is used by the respectiveapplication. While the processing capacity for the applications orservices can be adjusted dynamically through these Web serviceinterfaces, the data repositories upon which these applications rely arenot similarly adjustable. Typically, performing tasks such asprovisioning and scaling data storage are tedious manual procedures, inwhich a customer has to provide a database administrator (DBA) orsimilar expert user with configuration information and requirements,such that the DBA can determine whether the configuration is valid. TheDBA typically then has to enable, tune, and optimize the datarepository. There is no easy way for a customer to dynamically adjustthe data storage capacity, or manage other such aspects of a datarepository.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments in accordance with the present disclosure will bedescribed with reference to the drawings, in which:

FIG. 1 illustrates an environment in which various embodiments can beimplemented;

FIG. 2 illustrates an example separation of a control plane and a dataplane that can be used in accordance with various embodiments;

FIG. 3 illustrates an example process for requesting an action throughthe control plane to be performed in the data plane in accordance withone embodiment;

FIG. 4 illustrates an example process for monitoring and automaticallyperforming actions in the data plane in accordance with one embodiment;

FIG. 5 illustrates example communication flow between hosts in a dataplane and a workflow service in the control plane in accordance with oneembodiment; and

FIG. 6 illustrates an example of a display for generating a request foraction in the data plane to be submitted to a user interface of thecontrol plane in accordance with one embodiment.

DETAILED DESCRIPTION

Systems and methods in accordance with various embodiments of thepresent disclosure may overcome one or more of the aforementioned andother deficiencies experienced in conventional approaches to managingaspects of data storage in an electronic environment. In particular,various embodiments provide a separate control environment, or controlplane, that can be used to control aspects of a data environment, ordata plane. The functionality of a control plane can be provided as aset of Web services, enabling the control plane to act as a virtualdatabase administrator (DBA). A user or customer can submit a request tothe control plane through an externally-visible application programminginterface (API), for example, which can be analyzed to determine actionsto be performed in the data plane, such as actions that create, delete,modify, expand, or otherwise modify a data store or data storageinstance. A monitoring component of the control plane also can beprovided that can monitor the health or status of components in the dataplane, and can automatically determine actions to be taken in the dataplane. State information can be passed to a component of the data planefor each task necessary to perform the action, such that the controlplane can manage the performance of the tasks without having directaccess into the data stores or other such components of the data plane.Once provisioned, a user can native access to the data instance(s) inthe data plane, and can simply point existing applications (such asMySQL applications) to the DNS (domain name system) address or otherlocation information for the particular instance. There is norestriction or modification of query models or other such functionality,as a user can continue to use applications built on MySQL, Oracle, orother such database technology.

FIG. 1 illustrates an example of an environment 100 for implementingaspects in accordance with various embodiments. As will be appreciated,although a Web-based environment is used for purposes of explanation,different environments may be used, as appropriate, to implement variousembodiments. The environment 100 shown includes both a testing ordevelopment portion (or side) and a production portion. The productionportion includes an electronic client device 102, which can include anyappropriate device operable to send and receive requests, messages, orinformation over an appropriate network 104 and convey information backto a user of the device. Examples of such client devices includepersonal computers, cell phones, handheld messaging devices, laptopcomputers, set-top boxes, personal data assistants, electronic bookreaders, and the like. The network can include any appropriate network,including an intranet, the Internet, a cellular network, a local areanetwork, or any other such network or combination thereof. Componentsused for such a system can depend at least in part upon the type ofnetwork and/or environment selected. Protocols and components forcommunicating via such a network are well known and will not bediscussed herein in detail. Communication over the network can beenabled by wired or wireless connections, and combinations thereof. Inthis example, the network includes the Internet, as the environmentincludes a Web server 106 for receiving requests and serving content inresponse thereto, although for other networks an alternative deviceserving a similar purpose could be used as would be apparent to one ofordinary skill in the art.

The illustrative environment includes at least one application server108 and a data store 110. It should be understood that there can beseveral application servers, layers, or other elements, processes, orcomponents, which may be chained or otherwise configured, which caninteract to perform tasks such as obtaining data from an appropriatedata store. As used herein the term “data store” refers to any device orcombination of devices capable of storing, accessing, and retrievingdata, which may include any combination and number of data servers,databases, data storage devices, and data storage media, in anystandard, distributed, or clustered environment. The application servercan include any appropriate hardware and software for integrating withthe data store as needed to execute aspects of one or more applicationsfor the client device, handling a majority of the data access andbusiness logic for an application. The application server providesaccess control services in cooperation with the data store, and is ableto generate content such as text, graphics, audio, and/or video to betransferred to the user, which may be served to the user by the Webserver in the form of HTML, XML, or another appropriate structuredlanguage in this example. The handling of all requests and responses, aswell as the delivery of content between the client device 102 and theapplication server 108, can be handled by the Web server. It should beunderstood that the Web and application servers are not required and aremerely example components, as structured code discussed herein can beexecuted on any appropriate device or host machine as discussedelsewhere herein. Further, the environment can be architected in such away that a test automation framework can be provided as a service towhich a user or application can subscribe. A test automation frameworkcan be provided as an implementation of any of the various testingpatterns discussed herein, although various other implementations can beused as well, as discussed or suggested herein.

The environment also includes a development and/or testing side, whichincludes a user device 118 allowing a user such as a developer, dataadministrator, or tester to access the system. The user device 118 canbe any appropriate device or machine, such as is described above withrespect to the client device 102. The environment also includes adevelopment server 120, which functions similar to the applicationserver 108 but typically runs code during development and testing beforethe code is deployed and executed on the production side and isaccessible to outside users, for example. In some embodiments, anapplication server can function as a development server, and separateproduction and testing storage may not be used.

The data store 110 can include several separate data tables, databases,or other data storage mechanisms and media for storing data relating toa particular aspect. For example, the data store illustrated includesmechanisms for storing production data 112 and user information 116,which can be used to serve content for the production side. The datastore also is shown to include a mechanism for storing testing data 114,which can be used with the user information for the testing side. Itshould be understood that there can be many other aspects that may needto be stored in the data store, such as for page image information andaccess right information, which can be stored in any of the above listedmechanisms as appropriate or in additional mechanisms in the data store110. The data store 110 is operable, through logic associated therewith,to receive instructions from the application server 108 or developmentserver 120, and obtain, update, or otherwise process data in responsethereto. In one example, a user might submit a search request for acertain type of item. In this case, the data store might access the userinformation to verify the identity of the user, and can access thecatalog detail information to obtain information about items of thattype. The information then can be returned to the user, such as in aresults listing on a Web page that the user is able to view via abrowser on the user device 102. Information for a particular item ofinterest can be viewed in a dedicated page or window of the browser.

Each server typically will include an operating system that providesexecutable program instructions for the general administration andoperation of that server, and typically will include a computer-readablemedium storing instructions that, when executed by a processor of theserver, allow the server to perform its intended functions. Suitableimplementations for the operating system and general functionality ofthe servers are known or commercially available, and are readilyimplemented by persons having ordinary skill in the art, particularly inlight of the disclosure herein.

The environment in one embodiment is a distributed computing environmentutilizing several computer systems and components that areinterconnected via communication links, using one or more computernetworks or direct connections. However, it will be appreciated by thoseof ordinary skill in the art that such a system could operate equallywell in a system having fewer or a greater number of components than areillustrated in FIG. 1. Thus, the depiction of the system 100 in FIG. 1should be taken as being illustrative in nature, and not limiting to thescope of the disclosure.

An environment such as that illustrated in FIG. 1 can be useful for aprovider such as an electronic marketplace, wherein multiple hosts mightbe used to perform tasks such as serving content, authenticating users,performing payment transactions, or performing any of a number of othersuch tasks. Some of these hosts may be configured to offer the samefunctionality, while other servers might be configured to perform atleast some different functions. The electronic environment in such casesmight include additional components and/or other arrangements, such asthose illustrated in the configuration 200 of FIG. 2, discussed indetail below.

Systems and methods in accordance with one embodiment provide arelational database service (“RDS”) that enables developers, customers,or other authorized users to easily and cost-effectively obtain andconfigure relational databases so that users can perform tasks such asstoring, processing, and querying relational data sets in a cloud. Whilethis example is discussed with respect to the Internet, Web services,and Internet-based technology, it should be understood that aspects ofthe various embodiments can be used with any appropriate servicesavailable or offered over a network in an electronic environment.Further, while the service is referred to herein as a “relationaldatabase service,” it should be understood that such a service can beused with any appropriate type of data repository or data storage in anelectronic environment. An RDS in this example includes at least one Webservice that enables users or customers to easily manage relational datasets without worrying about the administrative complexities ofdeployment, upgrades, patch management, backups, replication, failover,capacity management, scaling, and other such aspects of data management.Developers are thus freed to develop sophisticated cloud applicationswithout worrying about the complexities of managing the databaseinfrastructure.

An RDS in one embodiment provides a separate “control plane” thatincludes components (e.g., hardware and software) useful for managingaspects of the data storage. In one embodiment, a set of data managementapplication programming interfaces (APIs) or other such interfaces areprovided that allow a user or customer to make calls into the RDS toperform certain tasks relating to the data storage. The user still canuse the direct interfaces or APIs to communicate with the datarepositories, however, and can use the RDS-specific APIs of the controlplane only when necessary to manage the data storage or perform asimilar task.

FIG. 2 illustrates an example of an RDS implementation 200 that can beused in accordance with one embodiment. In this example, a computingdevice 202 for an end user is shown to be able to make calls through anetwork 206 into a control plane 208 to perform a task such as toprovision a data repository of the data plane 210. The user or anapplication 204 can access the provisioned repository directly throughan interface of a data plane 210. While an end user computing device andapplication are used for purposes of explanation, it should beunderstood that any appropriate user, application, service, device,component, or resource can access the interface(s) of the control planeand/or data plane as appropriate in the various embodiments. Further,while the components are separated into control and data “planes,” itshould be understood that this can refer to an actual or virtualseparation of at least some resources (e.g., hardware and/or software)used to provide the respective functionality.

The control plane 208 in this example is essentially a virtual layer ofhardware and software components that handles control and managementactions, such as provisioning, scaling, replication, etc. The controlplane in this embodiment includes a Web services layer 212, or tier,which can include at least one Web server, for example, along withcomputer-executable software, application servers, or other suchcomponents. The Web services layer also can include a set of APIs 232(or other such interfaces) for receiving Web services calls or requestsfrom across the network 206, which the Web services layer can parse orotherwise analyze to determine the steps or actions needed to act on orprocess the call. For example, a Web service call might be received thatincludes a request to create a data repository. In this example, the Webservices layer can parse the request to determine the type of datarepository to be created, the storage volume requested, the type ofhardware requested (if any), or other such aspects. Information for therequest can be written to an administration (“Admin”) data store 222, orother appropriate storage location or job queue, for subsequentprocessing.

A Web service layer in one embodiment includes a scalable set ofcustomer-facing servers that can provide the various control plane APIsand return the appropriate responses based on the API specifications.The Web service layer also can include at least one API service layerthat in one embodiment consists of stateless, replicated servers whichprocess the customer APIs. The Web service layer can be responsible forWeb service front end features such as authenticating customers based oncredentials, authorizing the customer, throttling customer requests tothe API servers, validating user input, and marshalling or unmarshallingrequests and responses. The API layer also can be responsible forreading and writing database configuration data to/from theadministration data store, in response to the API calls. In manyembodiments, the Web services layer will be the only externally visiblecomponent, or the only component that is visible to, and accessible by,customers of the control service. The servers of the Web services layercan be stateless and scaled horizontally as known in the art. APIservers, as well as the persistent data store, can be spread acrossmultiple data centers in a region, for example, such that the serversare resilient to single data center failures.

The control plane in this embodiment includes what is referred to hereinas a “sweeper” component 214. A sweeper component can be any appropriatecomponent operable to poll various components of the control plane orotherwise determine any tasks to be executed in response to anoutstanding request. In this example, the Web services layer might placeinstructions or information for the “create database” request in theadmin data store 222, or a similar job queue, and the sweeper canperiodically check the admin data store for outstanding jobs. Variousother approaches can be used as would be apparent to one of ordinaryskill in the art, such as the Web services layer sending a notificationto a sweeper that a job exists. The sweeper component can pick up the“create database” request, and using information for the request cansend a request, call, or other such command to a workflow component 216operable to instantiate at least one workflow for the request. Theworkflow in one embodiment is generated and maintained using a workflowservice as is discussed elsewhere herein. A workflow in general is asequence of tasks that should be executed to perform a specific job. Theworkflow is not the actual work, but an abstraction of the work thatcontrols the flow of information and execution of the work. A workflowalso can be thought of as a state machine, which can manage and returnthe state of a process at any time during execution. A workflowcomponent (or system of components) in one embodiment is operable tomanage and/or perform the hosting and executing of workflows for taskssuch as: repository creation, modification, and deletion; recovery andbackup; security group creation, deletion, and modification; usercredentials management; and key rotation and credential management. Suchworkflows can be implemented on top of a workflow service, as discussedelsewhere herein. The workflow component also can manage differencesbetween workflow steps used for different database engines, such asMySQL, as the underlying workflow service does not necessarily change.

In this example, a workflow can be instantiated using a workflowtemplate for creating a database and applying information extracted fromthe original request. For example, if the request is for a MySQL®Relational Database Management System (RDBMS) instance, as opposed to anOraclex RDBMS or other such instance, then a specific task will be addedto the workflow that is directed toward MySQL instances. The workflowcomponent also can select specific tasks related to the amount ofstorage requested, any specific hardware requirements, or other suchtasks. These tasks can be added to the workflow in an order of executionuseful for the overall job. While some tasks can be performed inparallel, other tasks rely on previous tasks to be completed first. Theworkflow component or service can include this information in theworkflow, and the tasks can be executed and information passed asneeded.

An example “create database” workflow for a customer might includestasks such as provisioning a data store instance, allocating a volume ofoff-instance persistent storage, attaching the persistent storage volumeto the data store instance, then allocating and attaching a DNS addressor other address, port, interface, or identifier which the customer canuse to access or otherwise connect to the data instance. In thisexample, a user is provided with the DNS address and a port address tobe used to access the instance. The workflow also can include tasks todownload and install any binaries or other information used for thespecific data storage technology (e.g., MySQL). The workflow componentcan manage the execution of these and any related tasks, or any otherappropriate combination of such tasks, and can generate a response tothe request indicating the creation of a “database” in response to the“create database” request, which actually corresponds to a data storeinstance in the data plane 210, and provide the DNS address to be usedto access the instance. A user then can access the data store instancedirectly using the DNS address and port, without having to access or gothrough the control plane 208. Various other workflow templates can beused to perform similar jobs, such as deleting, creating, or modifyingone of more data store instances, such as to increase storage. In someembodiments, the workflow information is written to storage, and atleast one separate execution component (not shown) pulls or otherwiseaccesses or receives tasks to be executed based upon the workflowinformation. For example, there might be a dedicated provisioningcomponent that executes provisioning tasks, and this component might notbe called by the workflow component, but can monitor a task queue or canreceive information for a provisioning task in any of a number ofrelated ways as should be apparent.

As mentioned, various embodiments can take advantage of a workflowservice that can receive requests or calls for a current state of aprocess or task, such as the provisioning of a repository, and canreturn the current state of the process. The workflow component and/orworkflow service do not make the actual calls or requests to performeach task, but instead manage the state and configuration informationfor the workflow that enables the components of the control plane todetermine the next task to be performed, and any information needed forthat task, then generate the appropriate call(s) into the data planeincluding that state information, whereby a component of the data planecan make the call to perform the task. Workflows and tasks can bescheduled in parallel in order to increase throughput and maximizeprocessing resources. As discussed, the actual performing of the taskswill occur in the data plane, but the tasks will originate from thecontrol plane. For example, the workflow component can communicate witha host manager, which can make calls into the data store. Thus, for agiven task a call could be made to the workflow service passing certainparameters, whereby the workflow service generates the sequence of tasksfor the workflow and provides the current state, such that a task forthe present state can be performed. After the task is performed (orotherwise resolved or concluded), a component such as the host managercan reply to the service, which can then provide information about thenext state in the workflow, such that the next task can be performed.Each time one of the tasks for the workflow is performed, the servicecan provide a new task to be performed until the workflow is completed.Further, multiple threads can be running in parallel for differentworkflows to accelerate the processing of the workflow.

The control plane 208 in this embodiment also includes at least onemonitoring component 218. When a data instance is created in the dataplane, information for the instance can be written to a data store inthe control plane, such as a monitoring data store 220. It should beunderstood that the monitoring data store can be a separate data store,or can be a portion of another data store such as a distinct set oftables in an Admin data store 222, or other appropriate repository. Amonitoring component can access the information in the monitoring datastore to determine active instances 234 in the data plane 210. Amonitoring component also can perform other tasks, such as collectinglog and/or event information from multiple components of the controlplane and/or data plane, such as the Web service layer, workflowcomponent, sweeper component, and various host managers. Using suchevent information, the monitoring component can expose customer-visibleevents, for purposes such as implementing customer-facing APIs. Amonitoring component can constantly monitor the health of all therunning repositories and/or instances for the control plane, detect thefailure of any of these instances, and initiate the appropriate recoveryprocess(es).

Each instance 234 in the data plane can include at least one data store226 and a host manager component 228 for the machine providing access tothe data store. A host manager in one embodiment is an application orsoftware agent executing on an instance and/or application server, suchas a Tomcat or Java application server, programmed to manage tasks suchas software deployment and data store operations, as well as monitoringa state of the data store and/or the respective instance. A host managerin one embodiment listens on a port that can only be reached from theinternal system components, and is not available to customers or otheroutside entities. In some embodiments, the host manager cannot initiateany calls into the control plane layer. A host manager can beresponsible for managing and/or performing tasks such as setting up theinstances for a new repository, including setting up logical volumes andfile systems, installing database binaries and seeds, and starting orstopping the repository. A host manager can monitor the health of thedata store, as well as monitoring the data store for error conditionssuch as I/O errors or data storage errors, and can restart the datastore if necessary. A host manager also perform and/or mange theinstallation of software patches and upgrades for the data store and/oroperating system. A host manger also can collect relevant metrics, suchas may relate to CPU, memory, and I/O usage.

The monitoring component can communicate periodically with each hostmanager 228 for monitored instances 234, such as by sending a specificrequest or by monitoring heartbeats from the host managers, to determinea status of each host. In one embodiment, the monitoring componentincludes a set of event processors (or monitoring servers) configured toissue commands to each host manager, such as to get the status of aparticular host and/or instance. If a response is not received after aspecified number of retries, then the monitoring component can determinethat there is a problem and can store information in the Admin datastore 222 or another such job queue to perform an action for theinstance, such as to verify the problem and re-provision the instance ifnecessary. The sweeper can access this information and kick off arecovery workflow for the instance to attempt to automatically recoverfrom the failure. The host manager 228 can act as a proxy for themonitoring and other components of the control plane, performing tasksfor the instances on behalf of the control plane components.Occasionally, a problem will occur with one of the instances, such asthe corresponding host, instance, or volume crashing, rebooting,restarting, etc., which cannot be solved automatically. In oneembodiment, there is a logging component (not shown) that can log theseand other customer visibility events. The logging component can includean API or other such interface such that if an instance is unavailablefor a period of time, a customer can call an appropriate “events” orsimilar API to get the information regarding the event. In some cases, arequest may be left pending when an instance fails. Since the controlplane in this embodiment is separate from the data plane, the controlplane never receives the data request and thus cannot queue the requestfor subsequent submission (although in some embodiments this informationcould be forwarded to the control plane). Thus, the control plane inthis embodiment provides information to the user regarding the failureso the user can handle the request as necessary.

As discussed, once an instance is provisioned and a user is providedwith a DNS address or other address or location, the user can sendrequests “directly” to the data plane 210 through the network using aJava Database Connectivity (JDBC) or other such client to directlyinteract with that instance 234. In one embodiment, the data plane takesthe form of (or at least includes or is part of) a computing cloudenvironment, or a set of Web services and resources that provides datastorage and access across a “cloud” or dynamic network of hardwareand/or software components. A DNS address is beneficial in such adynamic cloud environment, as instance or availability failures, forexample, can be masked by programmatically remapping a DNS address toany appropriate replacement instance for a use. A request received froma user 202 or application 204, for example, can be directed to a networkaddress translation (NAT) router 224, or other appropriate component,which can direct the request to the actual instance 234 or hostcorresponding to the DNS of the request. As discussed, such an approachallows for instances to be dynamically moved, updated, replicated, etc.,without requiring the user or application to change the DNS or otheraddress used to access the instance. As discussed, each instance 234 caninclude a host manager 228 and a data store 226, and can have at leastone backup instance or copy in persistent storage 230. Using such anapproach, once the instance has been configured through the controlplane, a user, application, service, or component can interact with theinstance directly through requests to the data plane, without having toaccess the control plane 232. For example, the user can directly issuestructured query language (SQL) or other such commands relating to thedata in the instance through the DNS address. The user would only haveto access the control plane if the user wants to perform a task such asexpanding the storage capacity of an instance. In at least oneembodiment, the functionality of the control plane 208 can be offered asat least one service by a provider that may or may not be related to aprovider of the data plane 210, but may simply be a third-party servicethat can be used to provision and manage data instances in the dataplane, and can also monitor and ensure availability of those instancesin a separate data plane 210.

As discussed, one advantage to providing the functionality of a controlplane as a Web service or other such service is that the control planefunctions as a virtual database administrator (DBA) and avoids the needfor a human DBA to perform tasks such as provisioning data. Provisioningdata is presently a tedious manual procedure, requiring a DBA to receivethe necessary configuration information, determine whether theconfiguration is valid, optimize and tune the instance, and performother such tasks, which take a significant amount of time and effort.Further, such an approach provides many opportunities for error, whichmight not be discovered until after data is lost. Using a control planeor service as described herein, a user or customer can instead submit acall including information such as a type of hardware and a version of adatabase product. The control plane or service can then perform thenecessary tasks to create, delete, modify, expand, or otherwise modify adata store or data storage instance. The control plane also can supportseveral different database engines in a consistent fashion, withoutrequiring a DBA to be an expert in each of the engines. Onceprovisioned, the user has native access to the data instance(s), and cansimply point existing applications (such as MySQL applications) to theDNS address or other location information for the particular instance.There is no restriction or modification of query models or other suchfunctionality, as a user can continue to use applications built onMySQL, Oracle, or other database technology.

Using components such as those discussed above, FIG. 3 illustrates anexample process 300 by which a customer can request the performance of acontrol-related task with respect to at least one data instance in adata environment, here the data plane, using the control plane or asimilar data control service. While the term “customer” is used hereinto refer to the “owner” of data, or a data store or instance hosted bythe RDS system, it should be understood that the term customer is merelyan example, and that any appropriate user or developer can be allowed toaccess the control plane and data plane in the various embodiments. Arequest, such as a Web services call, is received through acustomer-facing control plane interface component 302. The request isanalyzed to determine at least one action needed to process the request304. As discussed, this can take the form of a component of a Webservices layer parsing the request to determine the action(s) beingrequested. In this embodiment, information for the action, such as thetype of action and parameters to be used to perform the action, iswritten to a job queue 306, such as may be located in an Admin datastore or other such storage location. The job queue can be monitored,such as by a sweeper component, to determine the presence of jobinformation 308 and, when job information is detected, a request can besent to initiate a workflow for the requested action 310. This caninclude a request sent by the sweeper component to a workflow componentand/or service to instantiate a workflow. In other embodiments, aworkflow component might monitor the job queue for jobs, or a componentof the Web services layer may send the job information directly to aworkflow component.

Upon receiving the job information, the information is analyzed todetermine and/or assemble an appropriate workflow for the requestedaction 312. As discussed, different tasks can be selected for theworkflow based upon factors such as the type of action requested and thetype of database engine being used. Beginning with the first task of theworkflow, state information is sent to a host manager in the dataenvironment operable to use the state information to determine a task tobe performed, perform the task with respect to a data repository and/ordata instance, and return a response upon completion of the task 314.Upon receiving the response, the workflow component determines whetherthere is another task to be performed 316. If so, state information forthe next task is sent to the host manager, and upon completion of thattask the host manager sends a response to the workflow component. Afterthe final task has been completed, a message is sent to the requestingcustomer (or another appropriate user, application, or location) thatthe requested action has been completed 318. After the action has beenperformed, the customer is able to directly access the data instanceupon which the action was performed using a data interface of the dataenvironment, without accessing or passing through the control plane 320.As mentioned, the user can provided with a DNS address and port number,for example, such that if the action resulted in movement of data oranother similar action, the customer or an application can continue touse the same DNS address, which will be directed to the appropriatelocation in the data plane.

Similarly, FIG. 4 illustrates an example process 400 by which a controlplane or control service can monitor the performance of a data instance(or data store, repository, etc.) in a data environment, here the dataplane. A request for status is sent to a host manager component for adata instance 402. A determination is made as to whether a response isreceived within a specified amount of time 404. If no response isreceived, it is determined whether a threshold number of requests havebeen sent 406. If a threshold number of requests have not been send,another request can be sent 408. If a response message is received, theresponse is analyzed to determine whether the message includes anyerrors or tasks to be addressed 410. If not, and the instance isdetermined to be healthy, the process can continue with another requestfor status being sent at a later time. If the response message indicatesthat an action needs to be performed with respect to the data instance,information for the action, such as the type of action and parameters tobe used to perform the action, is written to a job queue 412, such asmay be located in an Admin data store or other such storage location.The job queue can be monitored to determine the presence of jobinformation 414, such as by a sweeper component, and when jobinformation is detected, a request can be sent to initiate a workflowfor the requested action 416. In other embodiments, a workflow componentmight monitor the job queue for jobs, or a component of the Web serviceslayer may send the job information directly to a workflow component.

Upon receiving the job information, the information is analyzed todetermine and/or assemble an appropriate workflow for the requestedaction 418. Beginning with the first task of the workflow, stateinformation is sent to a host manager in the data environment to performthe task and execute the workflow 420, such as may be accomplished usinga process described with respect to steps 314 to 316 of the process ofFIG. 3. If the final task is completed successfully, the data instancecan simply continue to process requests sent from customers orapplications via a data plane interface. If any task cannot be completedsuccessfully, a message can be sent to a customer (or anotherappropriate user, application, or location) indicating a potentialproblem with the data instance. Various other notification actions canoccur, such as generating an action notification and/or addinginformation to an error log.

SPECIFIC INTERFACE EXAMPLES

As discussed above, users of the control plane can perform various tasksrelating to data repositories and data instances using a set of APIs orother such interfaces. While the selection and names of the example APIsare used for purposes of explanation, it should be apparent that otherselections, combinations, names, and other aspects can vary between thevarious embodiments. As discussed in one of the examples above,customers can create a data store using a “CreateDatabase” or similarAPI. The user can call a Web service to specify any desired values foran instance type (which describes the CPU and memory capacity), storagesize, repository name, port, and other such values. The customer couldalso utilize a “DescribeDatabase” or similar API to poll on the statusof the repository to determine the state of the repository, such aswhether the repository state is provisioned. When the status of databaseis “AVAILABLE,” for example, the customer can retrieve an endpoint whichis returned as part of a response to the DescribeDatabase call.Customers can delete a repository or instance using a “DeleteDatabase”or similar API. Customers also can have the ability to hibernate arepository or instance, placing an instance in a “sleep” state, forexample, using a “HibernateDatabase” or similar API. During such a“sleep” state, the data typically will not be accessible but the datawill be backed up durably. Customers can wake a hibernated datarepository or instance using a “ResumeDatabase” or similar API.

As mentioned earlier, a control plane or service can handle thecomplexity of not just database provisioning, but also tasks such asupgrades, patch management, backups, and failover. A customer cancontrol the times for backups and maintenance activities by enablingcustomers to specify (or modify) the backup window and maintenancewindow times while invoking a “CreateDatabase” (or “ModifyDatabase” orsimilar) API. Using a “ModifyDatabase” API, customers can increase thestorage size, change the instance type, or modify various other fields.

Customers also can be provided with at least one “Database AccessControl” or similar API. When a data repository is created, users canspecify one or more existing security groups to restrict network accessto the repository. Customers can authorize access to the repository byadding permission rules to the security group that is applied to therepository using an API such as an AuthorizeDBSecurityGroupIngress API.Customers can also add or remove security groups from a repository atany time using an API such as a “ModifyDatabase” API. Customers cancreate (or delete) security groups using similar APIs, such as a“CreateDBSecurityGroup” (or “DeleteDBSecurityGroups”) API.

A control plane also can provide at least one “Database User Management”or similar API. As part of a CreateDatabase API, for example, customersin one embodiment can be expected to supply the username and passwordfor a special repository user, such as may be called a “RepositoryOwner.” A Repository Owner is a special type of user who owns therepository schema objects. After creation of a repository, a customercan perform tasks such as to add more users to using a“CreateDatabaseUser” API, remove users using a “DeleteDatabaseUser” API,and list customers using a “DescribeDatabaseUsers” API. Customers alsocan obtain the history of events (such as outages due to maintenance orbackup related events) related to the repositories and instances using a“DescribeEvents” or similar API.

Customer Example

In this example a customer wants to provision a new data instance,instead of maintaining and managing an existing MySQL database. In thisexample, the existing CUSTOMER database is 60 GB, and storage growthestimates are around 10% per month. Based on these initial capacityrequirements, the customer selects an instance to be provisioned with aninitial capacity of 80 GB. The customer chooses a master user and masteruser password, and based on firewall requirements chooses an appropriateport number (e.g., 4030) on which the data instance will be listening.

The customer, if not already signed up or subscribed to the controlservice, can sign up for the service. In some embodiments, the user willreceive software or will access an interface page through the Internet,for example, that will allow a user to submit requests to the controlplane or service. For example, FIG. 5 illustrates an example of adisplay 500, here a page rendered in a browser application, that canallow a user to make calls into the control plane. As illustrated, theinterface can include options that allow the user to enter informationneeded to perform a control action on the data plane. For example, theinterface page can include options to specify a repository for theaction 502, select an action to be performed 504, and specify optionsfor the action 506, such as a database engine to be use or capacity tobe requested, as well as version information 508 or other such options.In other embodiments, a user can manually (or otherwise) create andsubmit Web service calls to the control plane. In the following example,the customer generates a request to create a new data repository using acommand line tool. A request can take the form of, for example:

rds-create-database --identifier customerprod --dbname customer - -size80 -class small --engine mysqI5.1 --master master_username --passwordmaster_password --port 4030The customer can have the ability to check on the provisioning status,and can request a connect string using the command line tool to describethe repository, such as by submitting:

-   -   describe-repositories customerprod        The customer can grant access to the default security group,        such as from the address range 205.192.0.0/16 by:    -   authorize default -s 205.192.0.0/16        The customer also can check on the status of security changes,        such as by submitting:    -   describe-group default

Once the request has been submitted, the control plane canasynchronously execute the request to provision the repository. A“DescribeDatabases” or similar API can be used to determine the statusof the request. While provisioning is still in progress, the status willshow as “Pending Creation,” for example, and can be changed to a statesuch as “Created” once the provisioning has been completed. At thispoint, the customer can have all the information necessary forconnecting to the repository.

Once the repository has been provisioned and is available, the customercan perform various actions on the data plane. For example, the customercan populate the CUSTOMER repository, such as by using a MySQL dumputility or similar data transfer process. The customer in this exampleruns a command (i.e., on the source MySQL database server using acompatible client utility) such as the following:

-   -   $ mysqldump -opt customer | mysql--host end_point_hostname        --port 4030 -C customer        The customer also can verify that the required tables are        created, such as by submitting:        The repository is ready for use by one of the customer's        applications. The customer changes the connect string (or other        pointer) for the application to point to new instance database        instead of the original self-managed database.

In this example, the customer also wants to implement data securitythrough role-based access control. Before turning on the provisioned andloaded data instance and making the instance available, the customerwants to implement role based access control such that a developmentteam will have read/write access to the repository but business analystswill only obtain read access. The client also wants “master user” accesslimited to handful of senior members, so the remaining developers need adifferent database user role.

With respect to the control plane, the customer can submit a request tocreate the new database user using the command line tool, for example,such as by submitting the following:

create-user --identifier customerprod --username develop1 --  passworddevelop1 create-user --identifier customerprod --username analyst1-- password analyst1The customer can also check on provisioning status for the request, suchas by submitting:

-   -   describe-users customerprod        While provisioning is still in progress, the status can show a        state such as “Pending Creation,” and the status will be changed        to a state such as “Created” once the provisioning has been        completed. The customer can now perform necessary tasks for        securing the users in the data plane.

The customer then can, with respect to the data plane, grant read/writeprivileges to a develop 1 user for all tables owned by master_username,such as by submitting:

$ mysql-u master_username -h end_point_hostname --port 4030 -p  master1Mysql>grant select, insert, update, delete on master_username.*  to′develop1′@′%′;The customer can also grant read privileges to an analyst1 user for alltables owned by master_username:

$ mysql-u master_username -h end_point hostname --port 4030 -p  master1Mysql>grant select on master_username.*to′analyst1′@′%′;

After the instance has been running for a while, the customer may decideto scale up the size of the instance, such as to 150 GB of storage. Thecustomer in this example thus can submit a request to modify thedatabase capacity using the command line tool, such as by submitting:

-   -   modify-database --identifier customerprod --size 150        If the system also allows to adjust the size of an instance for        compute or processing needs, then that adjustment can be made in        the same or a similar command by specifying an additional        parameter value. The customer also can check on a provisioning        status for the adjustment by submitting a command such as:    -   describe-databases customerprod        The requested repository modifications in one embodiment take        place during the maintenance window specified by the customer as        discussed above. While the changes are in progress, the status        be, for example, “Pending Modification,” which can be changed to        a value such as “Active” once the provisioning has been        completed. As discussed, the customer does not have to take any        actions on the data plane side during the execution of this        request. On the control plane side, the customer can subscribe        to a service such as an auto-scaling plan. Once subscribed, the        customer does not have to take any action, even on the control        plane, as the auto-scaling can be configured to manage capacity        for the customer and scale up or down as needed.

At some point, the customer may wish to implement improved or updatedprocesses for various development needs and may wish to set up a testinstance of a particular data store. The customer may also want to takea snapshot of the production instance so that the test instance is fullypopulated and comparable with the production date. The customer decidesthat, for the particular needs of the testing procedure, the customercan utilize a SMALL instance for purposes of processing capacity, andcan provision the same storage capacity as is used for production. Thecustomer thus can submit a request to clone the database using a commandline tool, such as by submitting:

create-database --identifier customertest --dbname tcustomer --  size150 --class small--engine mysq15.1--master master_username --passwordmaster_password--port 4030The customer can also check on the provisioning status by submitting acommand such as:

-   -   describe-databases customertest        The requested modifications can take place during the        maintenance window previously specified by the customer. While        the changes are in progress, the status will show as “Pending        Modification,” for example, and can be changed to a state such        as “Active” once the provisioning has been completed. The        customer does not have to take any actions on the data plane        side during the execution of this request. On the control plane        side, the customer can subscribe to a service such as        auto-scaling, as mentioned previously, such that once subscribed        the customer does not have to take any action even on the        control plan as the auto-scaling service will manage the scaling        for the customer.

As discussed previously, the use of a control plane or service inaccordance with various embodiments does not restrict the type of SQLqueries that a customer can run, and does not impose any restrictionsrelating to construction of a schema, such as to be partition ready andnot allow queries spanning partitions. Instead, a repository such as arelational database can be provisioned in a computing “cloud” withoutrestricting the users' schema or queries. As commonly known, even thoughthere is a theoretical SQL standard, the SQL quirks, syntaxes and theirbehaviors (e.g., NULL handling) vary across different relationaldatabase engines (e.g., MySQL, Oracle, or Postgres). For at least thesereasons, users may wish to choose a relational database engine that isfamiliar for purposes of programming and operations. Such an approachallows customers to use the same set of database tools that thecustomers have used previously for tasks such as data modeling,development, and debugging, even when the customers migrate their datastores to the cloud (or elsewhere) via the control plane. Using such anapproach, customers are not required to rewrite their application or anyoperational tools, which lowers the barrier of entry significantly forcustomers to move data to the cloud.

A customer's data repositories can be moved to the cloud in oneembodiment by running the repositories on compute nodes of a cloudcomputing environment. Block level storage volumes, such as off-instancestorage volumes that persist independently from the life of an instance,can be used with these instances for storing the repository binary, logsand volumes, for example. Such an approach can be advantageous, as thevirtualization provides flexibility to quickly and easily scale acompute and storage resources for a repository. Further, such anapproach can provide for persistent storage in the cloud.

As known in the art, relational databases can be run in different modes,such as may include: stand-alone (non-replicated), replicated, orreplicated and partitioned. A customer typically makes the choice ofwhich mode to run for a repository based on the availability andscalability needs of the repository and the incurred total cost ofownership (TCO). Some applications and services to not require arepository to be highly available and durable, and may instead utilize astand-alone repository that is able to tolerate outages on the order ofminutes. Other applications and servers can require a repository to bealways available, and require the repository to never lose data even inthe event of a failure. In this case, the applications and servicestypically require a replicated database offering. Some users,applications, or services require a massively scalable repository thatcan partition data across multiple repositories, such that scaling canoccur beyond the compute and storage capacity of a single database. Toaddress these different use cases, an approach in accordance with oneembodiment offers at least two modes, such as stand-alone and highavailability, for each database engine. Some embodiments also allowcustomers build their own partitioning layer on top of eitherstand-alone or high availability repositories.

As mentioned, the control plane layer can take advantage, or “sit ontop,” of various basic software frameworks for performing tasks such as:implementing workflows, establishing secure communication channelsbetween the host managers of the data plane and the components of thecontrol plane, installing software on the instances of the data plane,and performing various database backup and recovery procedures.

For example, a control plane layer can take advantage of a workflowservice to manage workflows. As commonly known, a key characteristic ofany workflow engine is that the engine enables asynchronous andresumable processing. As discussed above, a workflow can be thought ofas a state machine that starts with an initial state and goes through aseries of intermediate state transitions by executing different steps ofthe workflow before reaching the end goal. This end goal can be thoughtof as the terminal state of a state machine. A workflow service offersthe ability to create workflows, and provides hooks to determine thecurrent state of a given workflow and the step(s) to next be executed.The service can store the current state of the state machine, keepingtrack of the steps which executed successfully and the steps that mustbe executed to keep the workflow moving. The service does not, ingeneral, actually execute the state transitions for us. The precisetasks of executing the tasks for a workflow will in many embodiments beperformed by the “client” components of the workflow.

Since a control plane can have multiple workflows running in parallel atany given time, and these workflows can be for performing differenttasks, the control plane can take advantage of an architecture that isable to schedule multiple workflows and execute multiple activities inparallel. In one embodiment, the control plane includes various workerfleets that are programmed to execute the various workflow tasks. Theinteraction between these worker fleets and the workflow service will bedescribed with respect to the configuration 600 of FIG. 6. Each workerhost runs three components in this example, a poller component 604, adecider component 602, and a dispatcher component 606. Each host runs asingle poller thread, which polls the decider queue for each workflowtype. The decider queues are polled in one embodiment based on thepriority order of different workflow types. For instance, the deciderqueues can be polled for a recovery workflow ahead of a repositorycreation workflow. If, for example, a pollDeciderQueue API returns anon-empty list of decisions, the poller can forward the decisions to thedecider component. The decider component then can make a decisionregarding the next task to execute in a given workflow, and can call a“startActivity” or similar API to add the task to the activity queue fora given workflow. During the polling, the poller can move to the nexttask when the decider queue returns empty results, and can poll theactivity queue using a “PollActivityQueue” or similar API. If thepollActivityQueue API returns a non-empty list, this list can be handedover to a dispatcher threadpool, which can be tasked with executing theworkflow activity. Upon successful completion of the workflow activity,an “ActivityCompleted” or similar API can be called, which will call theworkflow service to enqueue in the decision queue.

Each workflow host in the workflow fleet runs a poller threader,decider, and dispatcher threadpool in this example. The workflows can bedefined in one embodiment using an annotations framework, and a workflowapplication can build these definitions at startup by reading from theappropriate classpath. The workflow service host first registers thelist of registered workflows and activity types using APIs of theworkflow sevice such as a “registerWorkflowType” and“registerActivityType” API. Since these APIs are idempotent in thisexample, each API can be called multiple times from multiple fleets.

New workflow instances of different workflow types may need to becreated for tasks such as repository creation, repository deletion,repository modification, repository recovery, repository backups, usercreation, user deletion, password reset, security management, and othersuch tasks. Each of these workflow instances can be created using asweeper that constantly sweeps the Admin repository for any changes tobe executed, as discussed above with respect to FIG. 2. For instance, ifa user wants to create a new repository then the Web service layer canstore the required configuration in Admin DB with a status column suchas “PENDING_CHANGES.” Each workflow host can runs a sweeper thread thatsweeps for any database or security group records with status set toPENDING_CHANGES, and can start a workflow accordingly.

While in some embodiments the workflow service's “createWorkflow” APIcan be called directly from the Web service layer as soon as therequired configuration is stored in the

Admin repository, calling the workflow service directly can result in atwo-phase commit style problem. If the workflow is not available fromthe workflow service, then the Admin repository updates have to berolled back and CreateDatabaseAPl call not accepted. To avoid suchtwo-phase commit style issues, various embodiments utilize the sweeperarchitecture that is operable to sweep for new workflow activities to bestarted by looking at changes to the Admin repository records with astatus set to be PENDING_CHANGES, for example.

Another architecture that can be utilized advantageously relates toproviding secure communications to the host managers of the data planefrom the components of the host plane. In one embodiment, the workflowand monitoring components of the control plane are constantlycommunicating with the host managers to perform various tasks (e.g.,database maintenance and software installation), as well as to check thestatus of the various instances and/or repositories. It is important inat least some embodiments that all communications between the controlplane and the host managers occur over a secure network that preventsanyone from eavesdropping or issuing unauthorized commands to the hostmanagers.

In one embodiment, all communication channels to the host managers aresecure using a hypertext transfer protocol over a secure socket layer(SSL). Each application server hosting a host manager application can bestarted using scripts at bootup of an instance. Before starting theapplication server engine, a script can be executed that generates aself-signed certificate and installs the certificate to enable the SSLcommunication channel(s). SSL communication is used in one embodimentfor encrypting the communication channel and not for clientauthentication. Client authentication is instead achieved with apublic/private key signature embedded in each request, such that in oneembodiment all clients sign query string parameters using a private key.This signature can be validated by a custom interceptor, which can bedeployed with the application server for the host manager. Further, asecurity group (i.e., firewall rules) can be established for eachmonitored instance in the data plane such that only hosts sitting in agiven network or secure group can communicate using the host managerport. Secure information and credentials (such as private keys) can bestored in an appropriate keystore, which can provide for functionalitysuch as key management and rotation.

Another architecture can be used to assist with software installationand maintenance. Software will generally need to be installed oninstances in the data plane instances during various stages of therepository lifecycle. To create a repository, various binaries and/orseeds may need to be installed. After the repository is created, variouspatches may need to be applied to the database, as well as criticalsecurity patches that may need to be installed to the operating system.It thus can be desirable in some embodiments to build upon a flexiblesoftware installation architecture or framework that enables theinstallation of different types of software on the various instances.One of the key requirements of such a framework may be to not only toinstall new software, but also to provide information on the current setof installed software and the respective versions. It also can bedesirable for such a framework to provide functionality to resolveconflicts during installation, verify the success of installation, andprovide APIs or other mechanisms to query the list of installedsoftware.

An installation framework in one embodiment takes advantage of a packetmanager such as RPM (Red Hat Package Manager), which enables software tobe distributed that is already compiled, such that the software can beinstalled with a single command. The software can be stored in a“bucket,” such that the software can be installed from pre-defined URLs.An RPM or similar installer command can take the package's manifest file(which can be another URL) and the RPM URL as two different parameters.The installed RPMs will be signed by the control plane and/or by RedHat, and both keys can be installed and maintained for the instances.Software installation in such a situation can be executed by a hostmanager, which can provide an “installSoftware” or similar API. Such anAPI can take into account parameters such as Package URL, Manifest URL,RetryCount, ForceInstall flag, and RPM root location). Upon invokingthis API, the manifest file will be downloaded, and each item will becompared to the currently installed list of applications. If the item isalready installed, then an attempt to reinstall will not be done unlessa “force install” or similar flag is specified. To check whether anindividual package has been installed, each host manager can provide a“getStatusofSoftware” or similar API. The “installSoftware” host managerAPI can be idempotent (as workflow may die and retry the step again) andasynchronous (as software installation takes a while to complete). Thesetwo aspects can be achieved by using a static object forsynchronization, which can prevent a second “installSoftware” call frominterfering with the first call.

An “install Software” API in accordance with one embodiment runs in aloop for a maximum of “RetryCount” times. The API also removes anyinstallation files which might exist from a previous failed attempt TheAPI can download a manifest file and determine which items need to beinstalled, then download the file(s) or package from an appropriaterepository or other source. The appropriate RPM files are then processedand installed. A final cleanup step then can be executed, regardless ofthe presence of any errors in the installation process.

The installation of the host manager application and any updates alsocan be managed for each instance, in a way that does not require takingdown all the other instances. In one embodiment, an instance starts theapplication server engine at bootup, and the host manager is installedby calling the application server manager framework to deploy the newhost application. As with other communications, the communication can beintercepted and the client authenticated before installing software orpushing updates to a host manager, which can be accomplished withoutaffecting the availability of existing repositories.

Another aspect that can rely upon an underlying framework relates torepository and data backup. It can be desirable for the control plane tobackup customer repositories and instance for various reasons, such asuser-initiated backups (which can be performed during the backup timewindows) and system-initiated backups during database restore, etc. Asingle framework can be implemented to handle both instances. To backupa repository, a framework can handle backing up both the data files andany associated log files. While various steps and processes will bedescribed, it should be understood that various steps and approaches candiffer from various database engines, such as My SQL and others.

An approach for backing up data in accordance with one embodimentsuspends data operations until shapshots are taken of the appropriatedata volumes, and the log files a similarly copied into an appropriatelocation. For example, an Admin tier can wait for the backup windowbefore initiating a backup procedure. Once inside the backup window, theAdmin tier can reate a workflow that will create a workflow instance forrepository backups. In one example, the workflow invokes a“supendDatabaseForBackup” or similar API for the host manager. This APIcan manage tasks to, for example, flush and lock the tables, suspend I/Oto the data volume, create and mount an LVM snapshot for the log volume,create a log position file with the last log position, and start a timerto resume the database. This timer can be used to resume the repositoryin case the Admin tier hangs up while performing a task, such as takingsnapshots, preventing the repository from being accidentally suspendedfor indefinite period of time. The workflow can poll the host managerfor completion of these and/or other such tasks. Once the workflow hasconfirmed that the host manager has suspended the repository, theworkflow can will attempt to backup the data volumes using a set ofordered tasks. For example, the workflow can indicate to createsnapshots of each data volume, and verify that the snapshots have beensuccessfully created. A row can be inserted for each snapshot volume ina location such as a backup_data_volumes table. Subsequently, theworkflow can invoke a host manager's “resumeDatabaseFromBackup” orsimilar API. This process can copy the repository logs and log positioninformation to an appropriate storage location, can unmount the logsnapshot, remove log snapshot log volume, and unlock all tables. TheAdmin tier then can create a customer event that indicates the backuphas been completed and the repository is again available.

As discussed, the log files also can be backed up in a similar fashion.The logs can be used to perform tasks such as replaying varioustransactions in case the data files have to be restored. The engine logscan be copied to an appropriate storage location, such that previouslybacked-up log files can be obtained using a simple list command. A hostmanager will use this result to determine whether there are logs thatneed to be copied. For example, the host manager can request a bucketlist to obtain the list of log files written such that the last sequencecan be backed up. If new logs have been created, it can first bedetermined that the logs are not actively being written to by a databaseengine, and then the logs can be copied and the copying verified to havebeen performed successfully.

Another aspect that can be handled by taking advantage of variousframeworks includes the management of various security aspects, such assecure keys and user credentials. Secure information such as secure keysand passwords can be stored using a secure key management system orservice, such as is described in co-pending U.S. patent application Ser.No. 12/372,597, Feb. 17, 2009, and entitled “Encryption Key Management,”which is hereby incorporated herein by reference. Such a service cancontain at least two versions for each credential, an ‘OLD’ version andthe current version. A key can be rotated, for example, by uploading thenew value for the key to the service, such as by using the base name forthe key, and launching a workflow to propagate that key value to hostmanagers as needed. Once that workflow is terminated successfully, suchthat each appropriate host has the new credential, the old version ofthe key can be effectively replaced with the new value. If, for anycredential, the old key does not match the new key, that is anindication that a key rotation process is currently underway. A new keyrotation is not started if the old key does not match the current key,as such an approach can risk losing credentials that may still be inuse. A command line utility or similar interface can be used to pushkeys to the key management service, which can enforce this check.

A separate workflow can be defined for updating and/or rotatingcredentials such as host manager credentials on all host managerinstances. Such an approach can utilize the same inputs as a“SendCredentials” or similar API on the each host manager, such ascredential type, public key, and optional private key. In place of thecredential value, however, the workflow can will accept the name of thekey used to store that value in the key management service. The workflowcan verify that the current value is different from the new value, andif the values are the same the workflow can terminate with anappropriate error condition. For each active host managed by the controlplane, a sub-workflow can be launched that will send the newcredential(s) to the host managers on each host. Once all thesub-workflows are complete, the new credential value can replace the oldvalue. Any host that is created or reactivated while this workflow is inprogress typically will need to be given the new version of thecredential instead of the original.

A sub-workflow for sending the credentials to a host can utilize requirethe same inputs as the original workflow, as well as the host name andport for the specific host manager. The sub-workflow can call an“UpdateCredentials” or similar API on the host manager for eachspecified credential, and can call a “GetCredentials” or similar API onthe host manager to verify that the update has completed. The hostmanager in at least one embodiment will not report the new value for thecredential until everything has been done to put the credential inplace. If all host managers are not updated within an appropriate periodof time, such as two hours (where two hours is configurable and easy toupdate as required), the workflow can time out and generate an errorticket or other such indication of failure. All the root/admincredentials used by a host manager to communicate with a repository canbe stored in the Admin repository in an encrypted form. When rotatingthe keys to encrypt passwords in the Admin repository, the new keys canbe uploaded to the management service and a workflow launched tore-encrypt all appropriate user passwords using the new key. Once thatworkflow completes successfully, the new encryption key can be used. Inaddition to changing the encryption keys, this workflow can also changethe root password for each database. A workflow for rotating passwordencryption keys can verify that the new encryption key is different fromthe old encryption key, encrypt any user passwords for in-flightworkflows with the new key, and encrypt the root passwords for anyinactive repositories with the new key. Since the repository isinactive, the passwords may not be changed but can be re-encrypted withthe new keys. For each active repository, a new root password can begenerated and stored in a pending changes field (encrypted with the newkey) and a sub-workflow can be launched for updating host managercredentials with the new password. When the sub-workflow completes, thenew root password can be written back to the data repository, using thenew encryption key. The root database password will not be changed whena repository is inactive, but the workflow that reactivates therepository can change the root password once the repository is active.

An approach in accordance with one embodiment utilizes a command lineutility that wraps a remote command and enforces restrictions on howcredentials are rotated. This can guarantee that public and private keysare only rotated in tandem, and that no key is rotated if a previousrotation is still in progress. The utility can verify that the keys weresuccessfully deployed to all hosts and then launch the appropriateworkflow in the appropriate control plane environment. A command lineutility can use a syntax such as:

rotate-rds-key \  --stage One of Devo, Integ, QA, or Prod\  --typecredential_type\  --publicKey value for public key \  --privateKeyoptional for some types; value for private keySuch a utility can fail if the current key is different from the old keyon any host in the fleet, there is an error copying the new key to anyhost in the fleet, or the workflow step could not be started. In thecase where the keys are already different, there may be no changes toroll back. The utility can roll back any changes in the other cases andalert the user of cases where the roll back was unsuccessful.

In a case where a host manager instance dies during an“UpdateCredentials” or similar workflow, allowing the workflow to retrycan handle many scenarios with no special logic on the workflow side.Workflow steps other than the step that is updating credentials mayreceive “MissingCredential” or similar exceptions from which theworkflows will need to recover. In such cases, it can be acceptable tosend the new credential to the host manager. In the case of a databaseadministration password, the password change may not have taken effect.The workflow step that tries to re-send the root password (as well asany other call to Host Manager that requires the root password fromother workflows) can fail with a “MissingCredentials” or similarexception. Workflow steps other than the change password workflow canattempt to set the credential to the new password and handle anyfailures. The workflow that is actively trying to change the passwordcan first try sending the new password. If that succeeds, the workflowis done; otherwise, the workflow can retry with the old passwordfollowed by the new password. If the host manager receives an“UpdateCredentials” or similar call for the root password where the hostmanager does not currently have a password in memory, the host managercan attempt to connect to the repository using that password and fail ifthe connection cannot be established.

The rotations of various credentials and secure objects are accomplishedin many instances without any noticeable impact on the customers. As theweb service layer in many embodiments does not use any of thesecredentials as part of processing customer requests, the customer APIcalls can continue to proceed as normal. The impact of rotating acredential can vary somewhat depending on the type of credential beingrotated. For example, when a new pair of Web services keys is generated,requests signed with the original pair may start to fail. This will onlyaffect workflow steps, in general, which the workflow system can retryfor a period of time. The new Web services credentials can be uploadedquickly to the management service in order to minimize the disruption toongoing workflows. While workflows for generating and propagating newpasswords are in progress, workflow boxes can have access to both oldand new encryption keys, such that connections can be made to individualrepositories and instances while each workflow is in progress. For hostmanager authentication keys, production hosts can have retry logic inplace to retry connections with the old key if requests are beingrejected. For RPM signing keys, host managers may be unable to installsoftware for some time if a key is rotated.

As discussed above, the various embodiments can be implemented in a widevariety of operating environments, which in some cases can include oneor more user computers, computing devices, or processing devices whichcan be used to operate any of a number of applications. User or clientdevices can include any of a number of general purpose personalcomputers, such as desktop or laptop computers running a standardoperating system, as well as cellular, wireless, and handheld devicesrunning mobile software and capable of supporting a number of networkingand messaging protocols. Such a system also can include a number ofworkstations running any of a variety of commercially-availableoperating systems and other known applications for purposes such asdevelopment and database management. These devices also can includeother electronic devices, such as dummy terminals, thin-clients, gamingsystems, and other devices capable of communicating via a network.

Various aspects also can be implemented as part of at least one serviceor Web service, such as may be part of a service-oriented architecture.Services such as Web services can communicate using any appropriate typeof messaging, such as by using messages in extensible markup language(XML) format and exchanged using an appropriate protocol such as SOAP(derived from the “Simple Object Access Protocol”). Processes providedor executed by such services can be written in any appropriate language,such as the Web Services Description Language (WSDL). Using a languagesuch as WSDL allows for functionality such as the automated generationof client-side code in various SOAP frameworks.

Most embodiments utilize at least one network that would be familiar tothose skilled in the art for supporting communications using any of avariety of commercially-available protocols, such as TCP/IP, OSI, FTP,UPnP, NFS, CIFS, and AppleTalk. The network can be, for example, a localarea network, a wide-area network, a virtual private network, theInternet, an intranet, an extranet, a public switched telephone network,an infrared network, a wireless network, and any combination thereof.

In embodiments utilizing a Web server, the Web server can run any of avariety of server or mid-tier applications, including HTTP servers, FTPservers, CGI servers, data servers, Java servers, and businessapplication servers. The server(s) also may be capable of executingprograms or scripts in response requests from user devices, such as byexecuting one or more Web applications that may be implemented as one ormore scripts or programs written in any programming language, such asJava®, C, C# or C++, or any scripting language, such as Perl, Python, orTCL, as well as combinations thereof. The server(s) may also includedatabase servers, including without limitation those commerciallyavailable from Oracle®, Microsoft®, Sybase®, and IBM®.

The environment can include a variety of data stores and other memoryand storage media as discussed above. These can reside in a variety oflocations, such as on a storage medium local to (and/or resident in) oneor more of the computers or remote from any or all of the computersacross the network. In a particular set of embodiments, the informationmay reside in a storage-area network (“SAN”) familiar to those skilledin the art. Similarly, any necessary files for performing the functionsattributed to the computers, servers, or other network devices may bestored locally and/or remotely, as appropriate. Where a system includescomputerized devices, each such device can include hardware elementsthat may be electrically coupled via a bus, the elements including, forexample, at least one central processing unit (CPU), at least one inputdevice (e.g., a mouse, keyboard, controller, touch screen, or keypad),and at least one output device (e.g., a display device, printer, orspeaker). Such a system may also include one or more storage devices,such as disk drives, optical storage devices, and solid-state storagedevices such as random access memory (“RAM”) or read-only memory(“ROM”), as well as removable media devices, memory cards, flash cards,etc.

Such devices also can include a computer-readable storage media reader,a communications device (e.g., a modem, a network card (wireless orwired), an infrared communication device, etc.), and working memory asdescribed above. The computer-readable storage media reader can beconnected with, or configured to receive, a computer-readable storagemedium, representing remote, local, fixed, and/or removable storagedevices as well as storage media for temporarily and/or more permanentlycontaining, storing, transmitting, and retrieving computer-readableinformation. The system and various devices also typically will includea number of software applications, modules, services, or other elementslocated within at least one working memory device, including anoperating system and application programs, such as a client applicationor Web browser. It should be appreciated that alternate embodiments mayhave numerous variations from that described above. For example,customized hardware might also be used and/or particular elements mightbe implemented in hardware, software (including portable software, suchas applets), or both. Further, connection to other computing devicessuch as network input/output devices may be employed.

Storage media and computer readable media for containing code, orportions of code, can include any appropriate media known or used in theart, including storage media and communication media, such as but notlimited to volatile and non-volatile, removable and non-removable mediaimplemented in any method or technology for storage and/or transmissionof information such as computer readable instructions, data structures,program modules, or other data, including RAM, ROM, EEPROM, flash memoryor other memory technology, CD-ROM, digital versatile disk (DVD) orother optical storage, magnetic cassettes, magnetic tape, magnetic diskstorage or other magnetic storage devices, or any other medium which canbe used to store the desired information and which can be accessed bythe a system device. Based on the disclosure and teachings providedherein, a person of ordinary skill in the art will appreciate other waysand/or methods to implement the various embodiments.

The specification and drawings are, accordingly, to be regarded in anillustrative rather than a restrictive sense. It will, however, beevident that various modifications and changes may be made thereuntowithout departing from the broader spirit and scope of the invention asset forth in the claims.

1.-20. (canceled)
 21. A system, comprising: one or more processors withassociated memory that implement a data store control service,configured to: receive, via a control interface of the data storecontrol service, configuration information from a client to create adata store in a database service; provision the data store usingcomputing resources in the database service in accordance with theconfiguration information and provide to the client access informationto access the data store via a data interface of the database service;receive, via the control interface, a storage capacity and a partitionscheme for the data store; configure the data store to partition dataacross a set of partition repositories according to the partitionscheme; and automatically manage the set of partitioned repositories toadjust the storage capacity of the data store based at least in part onan auto-scaling plan.
 22. The system of claim 21, wherein data storecontrol service is configured to provide the control interface as one ormore web services.
 23. The system of claim 21, wherein data storecontrol service is configured to generate the control interface as a webpage with one or more control elements to specify the configurationinformation.
 24. The system of claim 21, wherein: the configurationinformation specifies one of a plurality of database engines withdifferent query syntaxes; and the data store control service, configuredto provision different data stores using the different database engines.25. The system of claim 24, wherein the data store control service isconfigured to provision data stores using a structured query language(SQL) database engine.
 26. The system of claim 21, wherein data storecontrol service is configured to: receive, via the control interface,additional configuration information for replication of the data storeto one or more replication repositories; and provision the one or morereplication repositories using additional computing resources in thedatabase service in accordance with the additional configurationinformation.
 27. The system of claim 21, wherein to provide the accessinformation, the data store control service is configured to provide adomain name service (DNS) address for the data store.
 28. The system ofclaim 21, wherein the data store control service comprises a monitoringcomponent configured to: monitor status information about data stores inthe database service; store the status information in an administrationdata store; and provide one or more events via the control interfacebased at least in part on the status information.
 29. The system ofclaim 21, wherein the data store control service comprises a sweepercomponent configured to: determine a workflow of one or more tasks toperform for a request received via the control interface; and schedulethe workflow to be executed on the database service.
 30. The system ofclaim 29, wherein the sweeper component is configured to: determine thatone or more error conditions exists with the data store; and responsiveto one or more error conditions, initiate a recovery workflow to recoverthe data store.
 31. A computer-implemented method, comprising:performing, by one or more computer devices implementing a data storecontrol service, configured to: receiving, via a control interface ofthe data store control service, configuration information from a clientto create a data store in a database service; provisioning the datastore using computing resources in the database service in accordancewith the configuration information and provide to the client accessinformation to access the data store via a data interface of thedatabase service; receiving, via the control interface, a storagecapacity and a partition scheme for the data store; configuring the datastore to partition data across a set of partition repositories accordingto the partition scheme; and automatically managing the set ofpartitioned repositories to adjust the storage capacity of the datastore based at least in part on an auto-scaling plan.
 32. The method ofclaim 31, further comprising providing the control interface as one ormore web services.
 33. The method of claim 31, further comprisinggenerating the control interface as a web page with one or more controlelements to specify the configuration information.
 34. The method ofclaim 31, wherein: receiving the configuration information comprisingreceiving a specified one of a plurality of database engines withdifferent query syntaxes supported by the data store control service;and provisioning the data store is performed using the specifieddatabase engine.
 35. The method of claim 34, wherein provisioning thedata store comprises provisioning the data store using a structuredquery language (SQL) database engine.
 36. One or more non-transitorycomputer readable storage media comprising program instructions that,when executed on or across one or more processors of a data storecontrol service, cause the data store control service to: receive, via acontrol interface of the data store control service, configurationinformation from a client to create a data store in a database service;provision the data store using computing resources in the databaseservice in accordance with the configuration information and provide tothe client access information to access the data store via a datainterface of the database service; receive, via the control interface, astorage capacity and a partition scheme for the data store; configurethe data store to partition data across a set of partition repositoriesaccording to the partition scheme; and automatically manage the set ofpartitioned repositories to adjust the storage capacity of the datastore based at least in part on an auto-scaling plan.
 37. The one ormore non-transitory computer readable storage media of claim 36, whereinthe program instructions when executed on or across the one or moreprocessors cause the data store control service to provide the controlinterface as one or more web services.
 38. The one or morenon-transitory computer readable storage media of claim 36, wherein theprogram instructions when executed on or across the one or moreprocessors cause the data store control service to generate the controlinterface as a web page with one or more control elements to specify theconfiguration information.
 39. The one or more non-transitory computerreadable storage media of claim 36, wherein the program instructionswhen executed on or across the one or more processors cause the datastore control service to: receive in the configuration information aspecified one of a plurality of database engines with different querysyntaxes supported by the data store control service; and provisioningthe data store using the specified database engine.
 40. The one or morenon-transitory computer readable storage media of claim 36, wherein toprovide the access information, the program instructions when executedon or across the one or more processors cause the data store controlservice to provide a domain name service (DNS) address for the datastore.